Why the in email Email Address' infected are hidden

OK, this is a follow-up question to a previous post entitled "how to see the emails infected."

After receiving an e-mail usurped supposedly from a friend, I decide to examine the email address the email was sent by.

So I click 'Reply to all' but have no intention on send to anyone.

I then double-click each email address and page properties 'add a contact' pulls up (but I have no intention to add the contact to mine)

All except an email address, there was 1 standard email address which can be seen in the "personal e-mail" field

But on one of the email, not only is there the standard in the field 'email' personal e-mail, but another in the "work email" field

The field of work email has the address of: * e-mail address is removed from the privacy *.

In other words, one e-mail address in the field "To" a 2 address bound to it, while others have only the address of a.

So I find the work email address and found that her from somewhere in paris france and perhaps the source of identity theft.

But here's the issue at hand:

How does a secondary address we hidden?

So I checked the e-mail property page and the line 'To' only the standard e-mail in it, as in the e-mail message.

But there is no sign of this secondary "work email" on the line "to".

The only clue I have is on the E-mail property page:

Received: from [182.68.206.9] (helo = smtp.online .net)
by smtpauth - .net vit.online with esmtpa (Exim 4.80)
(envelope - from <*** email="" address="" is="" removed="" for="" privacy="" ***="">)
ID 1Yrk7w - 00015t - Er; Monday May 11, 2015 11:35:56 + 0200

Does anyone have any ideas as to how an e-mail address within the line 'to' can have both a personal and professional but only staff address is visible?

You may provide me with an example.

Is your intention to acquire the skills to do it yourself?

There are a lot more to an e-mail message that you can see in the header block. Each letter has a certain structure which you can study on Wikipedia while searching for keywords such as MIME. Here is an example. By not following the regulatory structure, spammers can generate different effects that can be detected by virus filters so they can mark it as spam. You can examine the raw content of an e-mail message with tools such as getmail.exe. Get ready to devoted considerable time to the effort.

Return-Path:<*** email="" address="" is="" removed="" for="" privacy="" ***="">
Delivered-To:<*** email="" address="" is="" removed="" for="" privacy="" ***="">
Received: from mx3.mail.xcom.com ([212.60.46.102])
by mbox5.mail.xcom.com (Dovecote) with LMTP id 10ciFvx7RVUkggAAseoyOg
for <*** email="" address="" is="" removed="" for="" privacy="" ***="">; Sunday May 3, 2015 03:38:34 + 0200
Received: from mailgw.webways.com (mailgw.webways.com [213.239.249.23])
by mx3.mail.xcom.com (Postfix) with ESMTP id 72D558054B
for <*** email="" address="" is="" removed="" for="" privacy="" ***="">; Sunday May 3, 2015 03:38:34 + 0200 (CEST)
Received: from localhost (localhost [127.0.0.1])
by mailgw.webways.com (Postfix) with ESMTP id 345513B 19
for <*** email="" address="" is="" removed="" for="" privacy="" ***="">; Sunday May 3, 2015 03:38:34 + 0200 (CEST)
X-Virus-analysis: by amavisd to mailgw.webways.com
Received: from mailgw.webways.com ([127.0.0.1])
by localhost (mailgw.webways.com [127.0.0.1]) (amavisd-new, port 10024)
with LMTP id 2725XERy1k2L for <*** email="" address="" is="" removed="" for="" privacy="" ***="">;
Sunday May 3, 2015 03:38:33 + 0200 (CEST)
Received: by mailgw.webways.com (Postfix, from userid 500)
ID 677B43B1B; Sunday May 3, 2015 03:38:33 + 0200 (CEST)
X - sieve: drawers sieve 0.4.1
X sieve-redirected-From: * e-mail address is removed from the privacy *.
Delivered-To: * e-mail address is removed from the privacy *.
Received: from localhost (localhost [127.0.0.1])
by mailgw.webways.com (Postfix) with ESMTP id 553BB3B1A
for <*** email="" address="" is="" removed="" for="" privacy="" ***="">; Sunday May 3, 2015 03:38:33 + 0200 (CEST)
X-Virus-analysis: by amavisd to mailgw.webways.com
Received: from mailgw.webways.com ([127.0.0.1])
by localhost (mailgw.webways.com [127.0.0.1]) (amavisd-new, port 10024)
with LMTP id 6X1qVxKKEDpl for <*** email="" address="" is="" removed="" for="" privacy="" ***="">;
Sunday May 3, 2015 03:38:32 + 0200 (CEST)
X-Original-Helo: wat.watadkitoko.com (iRedMail: http://code.google.com/p/iredmail/)
Received: from wat.watadkitoko.com (wat.watadkitoko.com [192.254.195.63])
by mailgw.webways.com (Postfix) with ESMTPS id 3B9813B19
for <*** email="" address="" is="" removed="" for="" privacy="" ***="">; Sunday May 3, 2015 03:38:32 + 0200 (CEST)
Received: from [188.207.81.194] (port = 19237 helo = User)
by wat.watadkitoko.com with esmtpa (Exim 4.85)
(envelope - from <*** email="" address="" is="" removed="" for="" privacy="" ***="">)
ID 1YoirL - 00020Q - YEAR; Saturday, may 2, 2015 20:38:21-0500
Reply-To:<*** email="" address="" is="" removed="" for="" privacy="" ***="">
From: rates Chehabi «»<*** email="" address="" is="" removed="" for="" privacy="" ***="">
Re: * SPAM * Important!
Date: Sunday 3 may 2015 03:38:09 + 0200
MIME-Version: 1.0
Content-Type: text/html;
charset = "Windows-1251".
Content-Transfer-Encoding: 7 bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced by Microsoft MimeOLE V6.00.2600.0000
X anti-abuse: this header was added to track abuse, please attach it to any report of abuse
X anti-abuse: primary Hostname - wat.watadkitoko.com
X anti-abuse: field Original - stone.com
X anti-abuse: author/caller UID/GID - [47 12] / [47 12]
X anti-abuse: sender address domain - pawpetstore.com
X Get-Message-Expéditeur-Via: wat.watadkitoko.com: authenticated_id: * e-mail address is removed from the privacy *.
Message-Id:<*** email="" address="" is="" removed="" for="" privacy="" ***="">
X-Spam-Flag: YES
X FCMA-Score: 100
X FCMA-analysis: v = 2,1 cv = Nafy1gz4 c = 0 sm = 1 tr = 0 p = Os_Rm99zqn0A:10
a = Z2k1iAh4l3CSraD9SQOBOg ==: 117 == a = Z2k1iAh4l3CSraD9SQOBOg: 17
a = 9cW_t1CCXrUA:10 a = Dyoqhi_TatcA:10




Greetings to you,


Good day to you. I'm sorry to bother you, but I have a great proposal for you. My name is

Rates Chehabi, I am of the Syria.

Can you allow me to inform you of my desire to enter into a business relationship with you personally

or from your company for a lucrative investment in the broad partnership owned by me and my Syrian

childhood best friend.

There was bad situation of things in Syria and the deterioration of things here day after day.

A lot of damage is still ongoing because I think're you aware of this fact.

I would like to know more about you and enter into a business relationship with you, our intention in

This issue is to have investments offshore project in your country because of lack of stability, subject to

change and political instability in Syria. I think you must have heard and seen a few about

these difficult times on CNN that happened for some time.

Your position in this arrangement will be as follows:

Best regards,

Rates Chehabi.

Tags: Windows

Similar Questions

Maybe you are looking for

  • Satellite L50-B-16V - Starcraft 2 performance decreased after update BIOS?

    Hello I played Starcraft 2 for awhile on my Satellite L50-B-16V using average settings quite fluently, however, now the computer's performance has worsened considerably. Framerate decreases with the increase of number of units in the game, in the end

  • After that the BIOS update cannot start my Satellite L305-S5885

    Last night I've updated the BIOS of my laptop, but when the completed BIOS flashing, she restarted Windows. The machine could not start. The CD/DVD device go into a cycle with a yellow light and the screen does not appear anything. Can someone help m

  • Satellite Pro 6000: What WLAn Module?

    HelloAnyone know which Module WLAn can be used in a Satellite Pro 6000.My NB is pre-installed for WLan but I don't want to use only 11MBit Module and the other are not signed for the SP6000.Can I use this module to 54 megabits?Thank youDaishi

  • my computer will not download updates for windows 7

    My computer stopped the download of updates about 3 weeks ago and now even when I press download updates it will not. It says download 35 updates and progress are always zero with 0 KG and it lasts for a long time now. Post proposed by the facilitato

  • Cannot find where to manually add TV stations in Windows Media Center

    Hello I use Windows Media Center with Windows 7 to watch live tv with a tv tuner. It works fine except there is a television station that I know is broadcast here that there's no signal with an auto-tune. I want to manually add this channel, but all